CVE-2021-29083: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter...

Synology DiskStation Manager 操作系统命令注入漏洞

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A security vulnerability exists in Synology DiskStation Manager, which allows...

CVE-2021-27275

This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be...

CVE-2021-27276: Improper Limitation of a Pathname to a Restricted Directory

This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

NETGEAR ProSAFE Network Management System MibController realName Directory Traversal Denial-of-Service Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...

PT-2021-17380

Name of the Vulnerable Software and Affected Versions NETGEAR ProSAFE Network Management System version 1.6.0.26 Description This issue allows remote attackers to delete arbitrary files on affected installations, potentially creating a denial-of-service condition. Although authentication is...

PT-2021-17379

Name of the Vulnerable Software and Affected Versions NETGEAR ProSAFE Network Management System version 1.6.0.26 Description This issue allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations. Although authentication is required to exploit th...

CVE-2018-19469

ArticleCMS through 2017-02-19 has XSS via the /updatepersonalinfomation realname or email parameter...

CVE-2018-19469

ArticleCMS through 2017-02-19 has XSS via the /updatepersonalinfomation realname or email parameter...

PT-2018-14971

Name of the Vulnerable Software and Affected Versions ArticleCMS versions prior to 2017-02-19 Description The issue allows for XSS attacks via the "/update personal infomation" API endpoint, specifically through the realname or email parameters. Recommendations For ArticleCMS versions prior to...

CVE-2018-19469: Improper Neutralization of Input During Web Page Generation

ArticleCMS through 2017-02-19 has XSS via the /updatepersonalinfomation realname or email parameter...

SQL Injection Vulnerability in the realName Parameter of the /www/index.php Page of Pleasant Reading Media's Digital Newspaper System

Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. There is a SQL injection vulnerability in this product, the vulnerability URL is:/www/index.php?mod=admin&con=user&realName=, the vulnerability parameter is: realName, the attacker can use the vulnerability t...

CVE-2016-1525

Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. dot dot in the realName parameter...

PT-2016-4851

Name of the Vulnerable Software and Affected Versions NETGEAR Management System NMS300 versions 1.5.0.11 and earlier Description A directory traversal issue exists in the data/config/image.do endpoint, allowing remote authenticated users to read arbitrary files by using a .. dot dot in the realNa...

CVE-2016-1525: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. dot dot in the realName parameter...

Netgear Management System NMS300 Directory Traversal Vulnerability

The Netgear Management System NMS300 is a network management system for diagnosing, controlling and optimizing network devices. A directory traversal vulnerability in the Netgear Management System NMS300's handling of the 'realName' parameter allows remote attackers to obtain arbitrary system fil...

CVE-2014-1572: Undefined Security Weakness

The confirmcreateaccount function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attacke...

PT-2014-4225

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 4.0.x before 4.0.15 Bugzilla versions 4.1.x and 4.2.x before 4.2.11 Bugzilla versions 4.3.x and 4.4.x before 4.4.6 Bugzilla versions 4.5.x before 4.5.6 Description The issue arises from the confirm create account...

SA-CONTRIB-2014-051 - Realname Registration - Information Disclosure

This module enables you to generate usernames based on fields filled out by the user during registration. The module doesn't sufficiently restrict access to the settings for determining which user fields are incorporated into usernames, and doesn't properly validate generated user names. Any user...

CVE-2012-2298

Multiple cross-site scripting XSS vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 "user names in page titles" and 2 "autocomplete callbacks."...